Claims
What was said, typed and attributed. Statements as reported by the cited publishers — not verified by DecisionGateway.
Follow via RSS — the 30 newest claims in any reader, no account needed.
Claims by
commitmentRed Hat Build of Keycloak users should apply RHSA-2026:56519 / 56520 / 56523 / 56524.turansecuritycommitmentUpgrade to 26.7.2 / 26.6.6 / 26.4.15 (LTS); the fix is also available in 26.8.0.turansecuritypredictionUnsupported branches (26.5, 26.3 and older) will not be fixed and remain permanently vulnerable until upgraded.turansecuritystatementAll versions prior to 26.7.2, 26.6.6 and 26.4.15 (LTS) are affected.turansecuritystatementExploit code has not yet been distributed, but the CVE is confirmed.turansecuritystatementThe cause is improper implementation of state checking (CWE-640).turansecurityallegationClicking the link in the email is not required; no authentication is required, no user interaction is needed, and MFA does not help.turansecurityallegationA critical vulnerability in Keycloak's reset-credentials (CVE-2026-18963, CVSS 9.1) allows any authenticated user, including administrators, to complete a password reset and set a new password.turansecuritycommitmentIt should be checked that there are no new .php files in /wp-content/uploads/.turansecuritycommitmentWAF and REST API request logs should be checked.turansecuritycommitmentThe site should be urgently updated to WordPress 7.0.2 or 6.9.5 version.turansecuritystatementThe vulnerability exists in WordPress 6.9.x (up to 6.9.5) and 7.0.x (up to 7.0.2) versions.turansecuritystatementDue to a serious vulnerability in the WordPress system and the REST API mechanism, an attacker can remotely break into the server without any additional information (such as login-password) (RCE).turansecurityinvestigationA serious vulnerability rated 9.8 was discovered in WordPress (CVE-2026-63030).turansecurity
14 of 14